Cloud Computing in GxP Environment Kathy Gniecko Hoffmann LaRoche 3rd April 2014, Stevenage 1
Introductions 18 years Experience in Pharma across all aspects of CSV. Prior to CSV experience in Pharma Research, Development and QC testing. Currently challenged to help IT deliver GxP sensitive solutions to the cloud in a compliant manner. 3rd April 2014, Stevenage 2
Cloud SIG - 2013 Cloud SIG was set up early 2013. A small team representing cross section of large/small Pharma and cloud service providers SMEs started working together in delivering the guidance to the industry and FDA. Goal Ongoing dialogue between GAMP/ISPE and FDA and mutual understanding of the challenges of operating in the Cloud Provide guidance on usage of cloud technologies in the GxP environment in order to accelerate adoption of this technology while maintaining control in a consistent manner. 3rd April 2014, Stevenage 3
Cloud SIG - 2013 3rd April 2014, Stevenage 4
Cloud SIG - 2013 Working representation of the delivery models and basic responsibilities 3rd April 2014, Stevenage 5
Cloud SIG - 2013 Cloud providers offer: Extremely fast and flexible solution delivery On-demand scalability Business continuity solutions Easy solutions for backup and archiving For a considerably lower cost than traditional in-house computing can match 3rd April 2014, Stevenage 6
Cloud SIG - 2013 Cloud providers offer: Extremely fast and flexible solution delivery On-demand scalability Business continuity solutions Easy solutions for backup and archiving For a considerably lower cost than traditional in-house computing can match BUT the framework for managing regulated systems. in the cloud needs examination 3rd April 2014, Stevenage 7
Cloud SIG - 2013 Cloud Providers: Diverse customer base (mostly non-pharma clients) Have more power than pharma companies to dictate how the quality aspects of the cloud business should run Some large cloud providers refuse to provide transparency on processes, consider this as proprietary information 3rd April 2014, Stevenage 8
Cloud SIG - 2013 High level problem statement and approach - the how Identification of friction areas _ business vs regulatory GAMP Position on acceptable risks 3rd April 2014, Stevenage 9
2014 Closing the GAP Recognize the different cloud deployment models. For each of these deployment modes, analyze the traditional IT controls and underlying actions. Obtain a clear and detailed overview of the responsibilities between the cloud service provider and pharma firms. Analyze if this new model will require different or additional controls to ratify the rigor of the pharma industry. 3 rd April 2014, Stevenage 10
Cloud SIG - 2014 High level problem statement and approach - the how Audit & Oversight Vendor Mgt Alternative Standards System Delivery Testing System Delivery (Complete Lifecycle) 3rd April 2014, Stevenage 11
Cloud SIG - 2014 Activities and Timelines 1Q14 2Q14 3Q14 4Q14 1Q15 3rd April 2014, Stevenage 12
Cloud SIG - 2014 Systematic Review of GAMP 5 Operational Controls Corresponding Responsibilities Insert picture from big spreadsheet Process element Process element; Service provider Health Authority regulated company Vendor management controls Initial assessment/ audit SLA / ongoing control Identify and Log Incident x - technical X - not being able to access "stuff" Incident Management CAPA Evaluate Incident Resolve Resume normal operations notification x - all Evaluate for what was running x x x x yes - notification based on impact - need to consider where limit is and timing x - for all incidents that effect the application Incident Closeout x x Identify and Log Problem x Determine Corrective Action x Root Cause Analysis x Determine Preventative Action x Document Outcome x Evaluate Success of CA and/or PA x 3rd April 2014, Stevenage 13
Objectives To Discuss: Language and attributes to describe Cloud providers Risk models to use to consider when moving to a cloud provider The level to which we would desire to be informed of Cloud provider Incidents and Problems 3rd April 2014, Stevenage 14
Cloud Vendor Models Capability/Enabler Bucket 1 GXP capable Bucket 2 GXP tolerant Bucket 3 unaware and intolerant Qualification Documents Customer Specific Change Practices Qualification Tools/ Guidance Permits Onsite Audit Ability to Support Enterprise Scale Service/Deployment Models Cost Profile 3rd April 2014, Stevenage 15
Public Cloud Provider - Private Cloud Risk Profiles Early Research Process/Data - Mfg / Distribution 3rd April 2014, Stevenage 16